Why Iran Is In Spotlight After Water Systems Hacked In 7 US States

In late July, the US state of Minnesota reported that at least 30 of its municipal water systems came under a "coordinated cyberattack," leaving many shocked. Days later, the Federal Bureau of Investigation (FBI) warned that malicious cyber actors broke into water and wastewater systems in at least seven states, causing operational disruptions and exposing glimpses of vulnerabilities in critical public services.

Since then, several US states, including Georgia, New Jersey, and South Dakota, have reported similar attacks, but it remains unclear if they are part of the seven states from the FBI's list. 

Initially, the Donald Trump administration blamed the hackers allegedly aligned with Iran for the cyberattacks, but the US government has yet to formally attribute the hacks to anyone.

US Water Machinery 

The federal government's data shows that there are 152,000 public drinking water systems and more than 16,000 wastewater treatment facilities across the US. Most municipalities get their water from lakes, reservoirs, rivers, or underground aquifers.

Electric pumps then move the water through pipes to a treatment plant that filters and disinfects it, pushing the treated supply into storage tanks, which further distribute it to houses, businesses, and public utility areas like parks and schools. 

The entire system can span across several square miles. 

How Hackers Are Targeting Supply

According to a CNN report, hackers are targeting internet-facing programmable logic controllers (PLCs) -- the devices that allow all industrial equipment to communicate at water facilities and other industrial plants. The programmable logic controllers monitor water pressure, chemical dosing, and other features in water systems to ensure it is safe for drinking. 

Workers at municipalities use dashboards to operate the controllers using wired networks, radio or cellular links, or internet connections.

William Akoto, Assistant Professor of Global Security at American University School of International Service, explained the anatomy of these cyberattacks in an article for The Conversation. He explained that attackers scan internet addresses for controllers, dashboards, and outside companies that provide remote access services, looking for targets that are linked directly to the internet.

Next, the criminals look for a default or stolen password to log in, an unpatched vulnerability, or a misconfigured remote-access service. They then exploit the access they have gained by changing a password, issuing commands, or attempting to alter the controller's software.

Is Iran Behind These Attacks? 

US officials, according to CBS News, are probing whether the cyber attacks could be linked to Iranian hackers, while cautioning that the assessment could change as additional technical evidence is collected. Iran also has a history of orchestrating similar attacks on Israeli supply. However, at a cabinet meeting last week, Trump blamed Minnesota authorities for the hack and cast doubt on whether Iran was involved.

"They like to say, "Oh, it's Iran." Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota," he said. 

Meanwhile, investigators are also probing to see whether another actor may have attempted to mimic Iranian tactics to mislead authorities.

Why These Attacks Matter

So far, there has been no report indicating that these attacks have corrupted any water system in a way that rendered drinking water unsafe. However, they have led to several disruptions requiring manual overrides and boil-water advisories issued out of caution.

But the experts have pointed out the biggest threat of the hacks may not be to the water supply itself, but what it could do to the public confidence in the security of their water.

"They're attacking our trust in our government to be able to deliver basic services in a time when, you know, you've got a deeply divided country over the war," Jake Braun, former acting White House Deputy National Cyber Director, told the BBC. 

What the US Can Do to Protect Its Supply

According to Akoto, the most immediate step that the US can take to protect itself is to remove controllers and human dashboards from direct connection to the internet. 

Following the Minnesota attacks, the Cybersecurity and Infrastructure Security Agency urged water utilities to place this equipment behind properly configured firewalls and other safeguards.

"When remote access is necessary, utilities should route communications through a secure gateway or VPN, require multiple levels of authentication, and limit how much access each user has. Utilities should change default passwords, disable unused remote-access services, and install vendor-approved updates to connected equipment," he wrote.

"In their guidance on internet-exposed dashboards, the cybersecurity agency also recommends separating operational networks from email and other business systems. This measure makes it harder for attackers to move between the two systems," Akoto added. 

He also advised that utilities should back up controller programs, log remote-access activity, and practice restoring systems and operating manually.